OpenSshift's Project based isolation support

The usual networking in OpenShift clusters is for projects to be isolating communication. Under this project based isolation there are a few rules:

* default namespace can talk to any pod/svc in any other namespace belonging to any project
* pods in any namespace belonging to any project can talk to pods/svcs in the default namespace
* pods in non default namespace can't talk to pods/svcs in other non defaults namespaces but their own.